Contact Access And Allowlists

Contact access controls who can communicate with an agent and who an agent can reach. This is one of the main safety controls for email, app channels, and external communication.

Direction matters

Contact permissions can cover different directions:

• Inbound: the contact can send messages or instructions to the agent.
• Outbound: the agent can send messages to the contact.
• Can configure: a separate contact permission to instruct the agent to change its charter or schedule where supported.

Grant only the communication direction and configuration authority the workflow needs. Collaborator invitations and web-app management permissions are separate; a contact allowlist entry does not grant those rights.

Allowlists

Allowlists are explicit contact rules. Use them when an agent should only interact with known people or endpoints.

Good allowlist practices:

• Add business contacts by role and purpose, not just because they might be useful.
• Remove stale contacts.
• Keep external outreach approval-gated for new agents.
• Review allowlists before enabling recurring email workflows.

Contact requests

An agent may ask for permission to contact someone. Review:

• The requested person or endpoint.
• The purpose of the contact.
• The direction of communication.
• Whether this is one-time or ongoing.
• Whether the contact should be a collaborator or only a communication endpoint.

If the request is too broad, reject it and provide a narrower instruction.

Channels

See Channels And Contacts for the user-facing channel model and Email for setup guidance.